package com.item.jdbc;
import com.item.pojo.Account;
import org.junit.Test;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.Statement;
import java.util.ArrayList;
import java.util.List;

public class UserLogin {
    //用户登录
    @Test
    public void tesLogin() throws Exception {
        //2.获取连接：如果连接的是本机mysql并且端口是默认的3306 可以简化书写
        // url="jdbc:mysql://127.0.0.1:3306/db1";
        String url = "jdbc:mysql:///db1?useSSL=false";
        String username = "root";
        String password = "";
        Connection conn = DriverManager.getConnection(url, username, password);

        //获取用户输入 用户名和密码
        String name = "zhangsan";
        String pwd = "123";

        String sql = "select * from tb_user where username = '" + name + "' and password = '" + pwd + "'";

        //获取stmt对象
        Statement stmt = conn.createStatement();

        //执行sql
        ResultSet rs = stmt.executeQuery(sql);

        //判断登录是否成功
        if (rs.next()) {
            System.out.println("登录成功");
        } else {
            System.out.println("登录失败");
        }
        //7.释放资源
        rs.close();
        stmt.close();
        conn.close();
    }

    /**
     * 演示SQL注入
     *
     * @throws Exception
     */
    @Test
    public void tesLogin_Inject() throws Exception {
        //2.获取连接：如果连接的是本机mysql并且端口是默认的3306 可以简化书写
        // url="jdbc:mysql://127.0.0.1:3306/db1";
        String url = "jdbc:mysql:///db1?useSSL=false";
        String username = "root";
        String password = "";
        Connection conn = DriverManager.getConnection(url, username, password);

        //获取用户输入 用户名和密码
        String name = "sdsdn";
        //' or '1' = '1
        String pwd = "' or '1' = '1";

        String sql = "select * from tb_user where username = '" + name + "' and password = '" + pwd + "'";
        System.out.println(sql);
        //获取stmt对象
        Statement stmt = conn.createStatement();

        //执行sql
        ResultSet rs = stmt.executeQuery(sql);

        //判断登录是否成功
        if (rs.next()) {
            System.out.println("登录成功");
        } else {
            System.out.println("登录失败");
        }
        //7.释放资源
        rs.close();
        stmt.close();
        conn.close();
    }
}